Typically I use a database such as MySQL or PostGreSQL on the same machine as the application using it, which makes access easy and secure. I'm just now building the first site that will have a separate physical database server (later this year it will). I'm wondering 3 things:

1. (security) What things should I look into for starters pertaining to security of accessing a separate machine's database?
2. (scalability) Are their scalability issues that I should think about pertaining to this (technology agnostic)?
3. (more ServerFaultish but related) If starting the DB out on the same physical server (using a separate VMWare VM) and later moving to a different physical server, are there implicit problems that I'll have to deal with? Isn't another VM still accessed via localhost?

If these questions are completely ludicrous, I apologize to you DB experts.